Protection of children in online spaces; public records exemption.

(1) DEFINITIONS.—As used in this section, the term:

(a) “Child” or “children” means a consumer or consumers who are under 18 years of age.

(b) “Collect” means to buy, rent, gather, obtain, receive, save, store, or access any personal information pertaining to a child.

(c) “Dark pattern” means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice and includes, but is not limited to, any practice the Federal Trade Commission refers to as a dark pattern.

(d) “Department” means the Department of Legal Affairs.

(e) “Online platform” means a social media platform as defined in s. 112.23(1), online game, or online gaming platform.

(f) “Personal information” means information that is linked or reasonably linkable to an identified or identifiable child, including biometric information and unique identifiers to the child.

(g) “Precise geolocation data” means information identified through technology which enables the online platform to collect specific location data which directly identifies the specific location of a child with precision and accuracy within a radius of 1,750 feet.

(h) “Processing” means any operation or set of operations performed on personal information or on sets of personal information, regardless of whether by automated means.

(i) “Profile” or “profiling” means any form of automated processing performed on personal information to evaluate, analyze, or predict personal aspects relating to the economic situation, health, personal preferences, interests, reliability, behavior, location, or movements of a child.

(j) “Sell” means to sell, rent, release, disclose, disseminate, make available, transfer, or otherwise communicate orally, in writing, or by electronic or other means, a child’s personal information or information that relates to a group or category of children by an online platform to another online platform or an affiliate or third party for monetary or other valuable consideration.

(k) “Share” means to share, rent, release, disclose, disseminate, make available, transfer, or access a child’s personal information for advertising or marketing. The term includes:

1. Allowing a third party to advertise or market based on a child’s personal information without disclosure of the personal information to the third party.

2. Monetary transactions, nonmonetary transactions, and transactions for other valuable consideration between an online platform and a third party for advertising or marketing.

(l) “Substantial harm or privacy risk to children” means the processing of personal information in a manner that may result in any reasonably foreseeable substantial physical injury, economic injury, or offensive intrusion into the privacy expectations of a reasonable child under the circumstances, including:

1. Mental health disorders or associated behaviors, including the promotion or exacerbation of self-harm, suicide, eating disorders, and substance abuse disorders;

2. Patterns of use that indicate or encourage addictive behaviors;

3. Physical violence, online bullying, and harassment;

4. Sexual exploitation, including enticement, sex trafficking, and sexual abuse and trafficking of online sexual abuse material;

5. Promotion and marketing of tobacco products, gambling, alcohol, or narcotic drugs as defined in s. 102 of the Controlled Substances Act, 21 U.S.C. s. 802; or

6. Predatory, unfair, or deceptive marketing practices or other financial harms.

(2) PROHIBITIONS.—An online platform that provides an online service, product, game, or feature likely to be predominantly accessed by children may not:

(a) Process the personal information of any child if the online platform has actual knowledge of or willfully disregards that the processing may result in substantial harm or privacy risk to children.

(b) Profile a child unless both of the following criteria are met:

1. The online platform can demonstrate it has appropriate safeguards in place to protect children.

2.a. Profiling is necessary to provide the online service, product, or feature requested for the aspects of the online service, product, or feature with which the child is actively and knowingly engaged; or

b. The online platform can demonstrate a compelling reason that profiling does not pose a substantial harm or privacy risk to children.

(c) Collect, sell, share, or retain any personal information that is not necessary to provide an online service, product, or feature with which a child is actively and knowingly engaged unless the online platform can demonstrate a compelling reason that collecting, selling, sharing, or retaining the personal information does not pose a substantial harm or privacy risk to children.

(d) Use personal information of a child for any reason other than the reason for which the personal information was collected, unless the online platform can demonstrate a compelling reason that the use of the personal information does not pose a substantial harm or privacy risk to children.

(e) Collect, sell, or share any precise geolocation data of children unless the collection of the precise geolocation data is strictly necessary for the online platform to provide the service, product, or feature requested and then only for the limited time that the collection of the precise geolocation data is necessary to provide the service, product, or feature.

(f) Collect any precise geolocation data of a child without providing an obvious sign to the child for the duration of the collection that the precise geolocation data is being collected.

(g) Use dark patterns to lead or encourage children to provide personal information beyond what personal information would otherwise be reasonably expected to be provided for that online service, product, game, or feature; to forego privacy protections; or to take any action that the online platform has actual knowledge of or willfully disregards that may result in substantial harm or privacy risk to children.

(h) Use any personal information collected to estimate age or age range for any other purpose or retain that personal information longer than necessary to estimate age. The age estimate must be proportionate to the risks and data practice of an online service, product, or feature.

(3) BURDEN OF PROOF.—If an online platform processes personal information pursuant to subsection (2), the online platform bears the burden of demonstrating that such processing does not violate subsection (2).

(4) ENFORCEMENT AND IMPLEMENTATION BY THE DEPARTMENT.—

(a) Any violation of subsection (2) is an unfair and deceptive trade practice actionable under part II of this chapter solely by the department against an online platform. If the department has reason to believe that an online platform is in violation of subsection (2), the department, as the enforcing authority, may bring an action against such online platform for an unfair or deceptive act or practice. For the purpose of bringing an action pursuant to this section, ss. 501.211 and 501.212 do not apply. In addition to other remedies under part II of this chapter, the department may collect a civil penalty of up to $50,000 per violation of this section. Civil penalties may be tripled for any violation involving a Florida child who the online platform has actual knowledge is under 18 years of age.

(b) After the department has notified an online platform in writing of an alleged violation, the department may in its discretion grant a 45-day period to cure the alleged violation. If the violation is cured to the satisfaction of the department and proof of such cure is provided to the department, the department may not bring an action for the alleged violation but, in its discretion, may issue a letter of guidance that indicates that the online platform will not be offered a 45-day cure period for any future violations. If the online platform fails to cure the violation within 45 calendar days, the department may bring an action against the online platform for the alleged violation.

(c) Any action brought by the department may be brought only on behalf of a Florida child.

(d) The department may adopt rules to implement this section.

(e) Liability for a tort, contract claim, or consumer protection claim that is unrelated to an action brought under this subsection does not arise solely from the failure of an online platform to comply with this section.

(f) This section does not establish a private cause of action.

(5) JURISDICTION.—For purposes of bringing an action pursuant to this section, any person who meets the definition of online platform which operates an online service, product, game, or feature likely to be predominantly accessed by children and accessible by Florida children located in this state is considered to be both engaged in substantial and not isolated activities within this state and operating, conducting, engaging in, or carrying on a business, and doing business in this state, and is therefore subject to the jurisdiction of the courts of this state.

(6) PUBLIC RECORDS EXEMPTION.—

(a) All information received by the department pursuant to a notification of a violation under this section, or received by the department pursuant to an investigation by the department or a law enforcement agency of a violation of this section, is confidential and exempt from s. 119.07(1) and s. 24(a), Art. I of the State Constitution, until such time as the investigation is completed or ceases to be active. This exemption shall be construed in conformity with s. 119.071(2)(c).

(b) During an active investigation, information made confidential and exempt pursuant to paragraph (a) may be disclosed by the department:

1. In the furtherance of its official duties and responsibilities;

2. For print, publication, or broadcast if the department determines that such release would assist in notifying the public or locating or identifying a person that the department believes to be a victim of a data breach or an improper use or disposal of customer records, except that information made confidential and exempt by paragraph (c) may not be released pursuant to this subparagraph; or

3. To another governmental entity in the furtherance of its official duties and responsibilities.

(c) Upon completion of an investigation or once an investigation ceases to be active, the following information received by the department shall remain confidential and exempt from s. 119.07(1) and s. 24(a), Art. I of the State Constitution:

1. All information to which another public records exemption applies.

2. Personal information.

3. A computer forensic report.

4. Information that would otherwise reveal weaknesses in the data security of an online platform.

5. Information that would disclose the proprietary information of an online platform.

(d) For purposes of this section, the term “proprietary information” means information that:

1. Is owned or controlled by the online platform.

2. Is intended to be private and is treated by the online platform as private because disclosure would harm the online platform or its business operations.

3. Has not been disclosed except as required by law or a private agreement that provides that the information will not be released to the public.

4. Is not publicly available or otherwise readily ascertainable through proper means from another source in the same configuration as received by the department.

5. Includes competitive interests, the disclosure of which would impair the competitive advantage of the online platform who is the subject of the information.

(e) This section is subject to the Open Government Sunset Review Act in accordance with s. 119.15 and shall stand repealed on October 2, 2028, unless reviewed and saved from repeal through reenactment by the Legislature.